Certified Information Security Manager (CISM) Information Security Risk Response and Reporting Syllabus

Why should business/process owners, not the security team, own and accept risks?

Because they own the assets and have the authority and budget to make business-impact decisions; security advises but does not own business risk.

What must accompany a formal risk acceptance decision?

Documented justification, the approving risk owner's authority/sign-off, the residual risk level, and a defined review/expiration date.

What is 'risk appetite'?

The amount and type of risk an organization is willing to pursue or retain to achieve its objectives, set by senior management/board.

What is 'risk tolerance'?

The acceptable level of variation (deviation) around risk appetite for a specific risk or objective — the practical threshold/boundary for retaining risk.

What is the difference between risk appetite and risk tolerance?

Risk appetite is the broad, strategic level of risk the organization is willing to take; risk tolerance is the specific, often quantified, acceptable deviation at the operational level.

What is 'risk capacity'?

The maximum amount of risk an organization can absorb before threatening its viability — the objective ceiling within which appetite is set.

Why is ongoing risk monitoring necessary after treatment?

Because risk is dynamic — threats, vulnerabilities, assets, and business context change, so previously acceptable residual risk can drift outside tolerance over time.

What is a Key Risk Indicator (KRI)?

A metric that provides an early warning signal of increasing risk exposure, often with thresholds that trigger escalation when breached.

What characteristics make an effective KRI?

Measurable, relevant/linked to a specific risk, predictive (leading indicator), reliable, and tied to defined thresholds for action.

What is the difference between a KRI and a KPI?

A KRI signals the level/likelihood of risk (early warning of exposure), while a KPI measures performance against business objectives. A KRI may be derived from KPI thresholds.

What is the difference between a KRI and a KCI?

A KRI indicates the level of risk exposure; a KCI indicates how well a specific control is performing. A failing KCI can drive a worsening KRI.

What events should trigger a reassessment of a previously assessed risk?

Significant changes such as new threats/vulnerabilities, major system or business process changes, mergers, new regulations, incidents, or audit findings.

What is 'continuous monitoring' in risk management?

The ongoing, often automated collection and analysis of control and risk data to maintain near-real-time awareness of the organization's risk posture.

What is a risk register?

A central repository/document that records identified risks along with their description, owner, assessment (likelihood/impact), treatment, status, and residual risk.

What are the essential data elements typically captured for each entry in a risk register?

Risk ID/description, owner, likelihood and impact, inherent and residual risk ratings, treatment/response, controls, status, and review date.

What is the primary purpose of maintaining a risk register?

To provide a single, current view of the organization's risks for prioritization, tracking treatment, accountability, and management reporting/decision-making.

Why must a risk register be kept current ('living document')?

Because outdated entries lead to poor decisions; risks, controls, and residual levels change, and the register supports ongoing monitoring and reporting.

What is 'aggregate risk' and why does the register help reveal it?

Aggregate risk is the combined exposure from multiple individual risks that may be acceptable alone but significant together; a register lets management view and total exposures across the organization.

What is the primary purpose of risk reporting to senior management and the board?

To communicate the organization's risk posture in business terms so leaders can make informed decisions on resource allocation and risk acceptance.

Why should risk reports be tailored to the audience?

Because executives/board need concise, business-impact and trend information for decisions, while operational staff need detailed technical metrics; reporting must match the audience's needs and authority.

What is risk escalation and when should a risk be escalated?

Escalation is raising a risk to a higher authority for decision/action. It occurs when a risk exceeds the owner's tolerance/authority, breaches a KRI threshold, or requires resources/acceptance beyond the owner's level.

What visualization tool commonly summarizes risk levels for management reporting?

A risk heat map (risk matrix) plotting likelihood against impact, using color coding to prioritize risks.

Why must risk reporting be timely and consistent?

So decisions are based on current information and trends can be compared over time; inconsistent or late reporting undermines credibility and decision quality.

At what stage of the SDLC is it most cost-effective to address security risk?

As early as possible — in the requirements/design phases — because fixing security flaws later (testing/production) is far more expensive and disruptive ('shift left').

What is 'security by design'?

Integrating security requirements and controls into every SDLC phase from the start, rather than adding security after development is complete.

In the SDLC, what security activity belongs in the requirements/design phase?

Defining security and compliance requirements, performing threat modeling, and conducting a risk assessment to drive control selection in the design.

What security control gate should occur before a system moves into production?

Security testing/assessment and formal authorization (certification and accreditation / sign-off) confirming residual risk is acceptable before go-live.

What is the most important risk concern in the disposal/decommission phase of the SDLC?

Secure data sanitization/destruction and proper disposal of media to prevent disclosure of residual sensitive information.

In a third-party/cloud arrangement, can an organization transfer accountability for its data risk to the provider?

No. Responsibility for a control can be shared, but ultimate accountability for protecting the organization's data and meeting compliance remains with the organization.

What is the 'shared responsibility model' in cloud computing?

A division of security duties where the cloud provider secures the underlying infrastructure ('security of the cloud') and the customer secures their data, access, and configurations ('security in the cloud'), varying by IaaS/PaaS/SaaS.

What should be evaluated before onboarding a third party, and what contractual element governs ongoing security expectations?

Perform third-party due diligence/risk assessment (security posture, financials, compliance); govern via contracts with security requirements, SLAs, right-to-audit clauses, and breach-notification obligations. Foster a risk-aware culture so security becomes part of everyday behavior and decisions.